huntrule

PowerShell Module CLIP Launcher Obfuscation via cmd/clip Clipboard and System.String Formatting

Detects obfuscated PowerShell module commands that run cmd with clip.exe/clipboard payload formatting.

FreeUnreviewedSigmahighv1
title: PowerShell Module CLIP Launcher Obfuscation via cmd/clip Clipboard and System.String Formatting
id: e55f5e54-835e-407f-bd6d-86b0c3c6ef55
related:
  - id: 73e67340-0d25-11eb-adc1-0242ac120002
    type: derived
  - id: a136cde0-61ad-4a61-9b82-8dc490e60dd2
    type: derived
status: test
description: This rule flags obfuscated PowerShell usage that invokes cmd with clipboard-related operations and runs clip.exe (or clip) as part of the command chain. The pattern indicates an attempt to stage or pass payload content through the clipboard while reducing visibility through string formatting and encoded command structure. It relies on PowerShell module telemetry that captures the executed payload text and matches a specific cmd/clip/clipboard and .NET string formatting sequence.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_clip.yml
author: Jonathan Cheong, oscd.community, Huntrule Team
date: 2020-10-13
modified: 2024-04-05
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_module
  definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
  selection_4103:
    Payload|re: cmd.{0,5}(?:/c|/r).+clip(?:\.exe)?.{0,4}&&.+clipboard]::\(\s\\"\{\d\}.+-f.+"
  condition: selection_4103
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags obfuscated PowerShell usage that invokes cmd with clipboard-related operations and runs clip.exe (or clip) as part of the command chain. The pattern indicates an attempt to stage or pass payload content through the clipboard while reducing visibility through string formatting and encoded command structure. It relies on PowerShell module telemetry that captures the executed payload text and matches a specific cmd/clip/clipboard and .NET string formatting sequence.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.